Static task
static1
Behavioral task
behavioral1
Sample
19eb36516c1e95ee87731c7df8dc72830548b62b09da6da818028948f3429c27.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
19eb36516c1e95ee87731c7df8dc72830548b62b09da6da818028948f3429c27.exe
Resource
win10v2004-20231025-en
General
-
Target
19eb36516c1e95ee87731c7df8dc72830548b62b09da6da818028948f3429c27
-
Size
5.7MB
-
MD5
68c036f1d0d17591aaac856e755aebdb
-
SHA1
7da5c3f51979d80b08f973c48cd3ab2789ba4be2
-
SHA256
19eb36516c1e95ee87731c7df8dc72830548b62b09da6da818028948f3429c27
-
SHA512
a0a261d5517e62979d164aec363b2f229b98dae525978e4a268b244e1137e96f98bc904a39d6b7fb9f3b2575caed52c763e5d9449b52adfb1f0f6277c12dbbbe
-
SSDEEP
98304:yXYvM5TU9Pv8qiwKT4fZdaHY2WMo2IUzz:y4/pSwk4G7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 19eb36516c1e95ee87731c7df8dc72830548b62b09da6da818028948f3429c27
Files
-
19eb36516c1e95ee87731c7df8dc72830548b62b09da6da818028948f3429c27.exe windows:5 windows x86
5ec26b1fbeb8cddbb30d36a4af48fd72
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
DeleteFileA
GetPrivateProfileStringA
lstrlenA
GetCurrentDirectoryA
MoveFileA
FindClose
FindNextFileA
FindFirstFileA
SetFileAttributesA
CreateEventA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GlobalFree
WaitForSingleObject
SetEvent
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
HeapCompact
UnlockFileEx
LockFileEx
ReadConsoleInputW
SetConsoleMode
ReadConsoleInputA
PeekConsoleInputA
GetNumberOfConsoleInputEvents
VirtualQuery
Sleep
OpenProcess
GetSystemInfo
GetLastError
ReadProcessMemory
GetCurrentProcess
Module32Next
Module32First
CreateToolhelp32Snapshot
GetTickCount
GetCurrentDirectoryW
MultiByteToWideChar
HeapFree
VirtualProtect
DeleteCriticalSection
VirtualAlloc
GetProcessHeap
HeapAlloc
CloseHandle
QueryPerformanceFrequency
ResetEvent
FlushViewOfFile
ExpandEnvironmentStringsW
GetSystemTime
DeviceIoControl
DuplicateHandle
FindNextFileW
CreatePipe
RemoveDirectoryW
MoveFileW
SetCurrentDirectoryA
GetEnvironmentVariableA
GetFileAttributesW
GetProcessTimes
SetFileTime
GenerateConsoleCtrlEvent
GetFileAttributesExA
SetEnvironmentVariableW
SystemTimeToFileTime
FindFirstFileW
GetFullPathNameW
LoadLibraryExA
SetErrorMode
GetFileAttributesA
GetConsoleOutputCP
IsDBCSLeadByte
LocalFree
FormatMessageA
SetEndOfFile
SetEnvironmentVariableA
CreateProcessA
GetExitCodeProcess
WriteConsoleW
OutputDebugStringW
HeapReAlloc
SetStdHandle
DeleteFileW
SetFileAttributesW
SetCurrentDirectoryW
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileAttributesExW
SetConsoleCtrlHandler
FlushFileBuffers
CreateDirectoryW
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetOEMCP
GetACP
IsValidCodePage
GetModuleFileNameW
GetStdHandle
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
InitializeCriticalSectionAndSpinCount
SetLastError
UnhandledExceptionFilter
FileTimeToSystemTime
PeekNamedPipe
GetFileType
GetFileInformationByHandle
FileTimeToLocalFileTime
AreFileApisANSI
GetModuleHandleExW
ExitProcess
GetCPInfo
LoadLibraryExW
GetCurrentThreadId
GetFullPathNameA
GetDriveTypeW
RtlUnwind
RaiseException
GetCommandLineA
GetSystemTimeAsFileTime
ExitThread
CreateThread
IsDebuggerPresent
CreateFileW
IsProcessorFeaturePresent
HeapValidate
DecodePointer
EncodePointer
GetStringTypeW
QueryPerformanceCounter
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
GetVersionExA
GetSystemDirectoryA
LoadLibraryA
lstrlenW
GlobalUnlock
GlobalLock
GetProcAddress
FreeLibrary
WideCharToMultiByte
SetFilePointer
ReadFile
WriteFile
OutputDebugStringA
GetModuleHandleA
WinExec
GetCurrentThread
SetUnhandledExceptionFilter
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSize
RemoveDirectoryA
CreateDirectoryA
GetTempPathA
GlobalAlloc
CreateFileA
GetCurrentProcessId
VerifyVersionInfoW
GetVersion
VerSetConditionMask
user32
CharPrevA
DefWindowProcA
UnregisterClassA
RegisterClassExA
CreateWindowExA
LoadImageA
FlashWindowEx
DestroyIcon
InvalidateRect
GetDC
FillRect
ReleaseDC
PeekMessageA
ClientToScreen
GetClientRect
OffsetRect
SetRect
IsWindow
DestroyWindow
MoveWindow
SetFocus
UpdateWindow
GetWindowLongA
SetWindowLongA
RegisterClassA
GetMenu
GetWindowRect
GetAsyncKeyState
PostQuitMessage
GetCursorPos
ScreenToClient
FindWindowA
LoadIconA
SetWindowPos
SystemParametersInfoA
GetKeyState
DestroyCursor
ShowCursor
SetCursor
SetCursorPos
SetCapture
ReleaseCapture
ChangeDisplaySettingsA
ShowWindow
GetCapture
GetSystemMetrics
LoadStringA
MessageBoxA
AdjustWindowRectEx
LoadCursorA
GetMessageA
TranslateMessage
DispatchMessageA
GetKeyboardLayoutNameA
GetKeyboardLayout
FindWindowExA
SetForegroundWindow
GetForegroundWindow
EnableWindow
CharPrevExA
CharNextExA
CharNextW
GetClipboardData
CloseClipboard
OpenClipboard
gdi32
CreateSolidBrush
DeleteObject
GetDIBits
TextOutW
StretchBlt
GetCharABCWidthsFloatW
GetTextExtentPoint32W
SelectObject
SetBkColor
BitBlt
TextOutA
SetTextColor
SetBkMode
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontIndirectA
EnumFontFamiliesExA
GetStockObject
GetTextExtentPoint32A
CreateDIBSection
advapi32
RegQueryValueA
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegSaveKeyA
RegEnumValueA
RegLoadKeyA
RegFlushKey
RegConnectRegistryA
CryptAcquireContextA
CryptGenRandom
RegDeleteValueA
RegQueryInfoKeyA
RegCreateKeyExA
RegCreateKeyA
RegEnumKeyExA
RegDeleteKeyA
RegSetValueExA
RegSetValueA
CryptReleaseContext
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
shell32
ShellExecuteA
SHGetSpecialFolderPathA
ShellExecuteW
SetCurrentProcessExplicitAppUserModelID
ole32
OleSetContainedObject
OleUninitialize
OleInitialize
CoGetClassObject
CoCreateInstance
CoInitialize
CoUninitialize
CoInitializeEx
winmm
timeGetTime
timeEndPeriod
timeGetDevCaps
timeBeginPeriod
d3d8
Direct3DCreate8
imm32
ImmGetCandidateListW
ImmIsIME
ImmNotifyIME
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetIMEFileNameA
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
devil
ilGenImages
ilInit
ilSetPixels
ilTexImage
ilSave
ilShutDown
ilDeleteImages
ilCopyPixels
ilConvertImage
ilGetInteger
ilLoad
ilOriginFunc
ilEnable
ilBindImage
iphlpapi
GetAdaptersInfo
GetPerAdapterInfo
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
imagehlp
GetTimestampForLoadedLibrary
EnumerateLoadedModules
StackWalk
granny2
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannyFreeMeshBinding@4
_GrannyGetSourceSkeleton@4
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannySetLogCallback@4
_GrannySetModelClock@8
_GrannyFindBoneByName@12
_GrannyNewWorldPose@4
_GrannyFreeWorldPose@4
_GrannyGetWorldPose4x4@8
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannySetControlSpeed@8
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@16
_GrannyFreeMeshDeformer@4
_GrannyDeformVertices@24
GrannyPNT332VertexType
_GrannyGetMeshBindingToBoneIndices@4
_GrannyGetControlLocalDuration@4
_GrannyGetControlSpeed@4
mss32
_AIL_file_read@8
_AIL_set_file_callbacks@16
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_auto_update_3D_position@8
_AIL_3D_sample_volume@4
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_mem_free_lock@4
_AIL_stream_status@4
_AIL_last_error@0
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_3D_sample_status@4
_AIL_set_3D_sample_loop_count@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_file@8
_AIL_end_3D_sample@4
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_set_stream_loop_count@8
speedtreert
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
??3CSpeedTreeRT@@SAXPAX@Z
??2CSpeedTreeRT@@SAPAXI@Z
??1CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0SGeometry@CSpeedTreeRT@@QAE@XZ
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
dinput8
DirectInput8Create
ws2_32
WSAGetLastError
inet_addr
socket
send
WSAStartup
recv
ioctlsocket
connect
closesocket
__WSAFDIsSet
gethostbyname
WSACleanup
htons
select
ddraw
DirectDrawCreate
oleaut32
SysFreeString
VariantClear
VariantInit
SysAllocString
Sections
.text Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 477KB - Virtual size: 789KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 476KB - Virtual size: 475KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ